feat(phase4): ArgoCD-driven Terraform apply via PostSync Hook Job

- Create Phase 4 ArgoCD Application (terraform-apply)
- PostSync Hook Job runs: terraform init && terraform apply -auto-approve
- ServiceAccount + ClusterRole for cluster-admin RBAC
- S3 credentials encrypted with SOPS (terraform-s3-secrets.enc.yaml)
- Pre-commit hook blocks local 'terraform apply' — all changes via git push
- True IaC: modify terraform/*.tf → git push → ArgoCD applies automatically

k8s/hooks/phase4/terraform-apply-hook.yaml

@@ -0,0 +1,68 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: terraform-apply
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: HookSucceeded
+spec:
+  backoffLimit: 3
+  template:
+    spec:
+      serviceAccountName: terraform-apply
+      containers:
+      - name: terraform
+        image: hashicorp/terraform:latest
+        command: ["/bin/sh", "-c"]
+        args:
+        - |
+          set -e
+
+          echo "=== Terraform Apply Hook (ArgoCD PostSync) ==="
+
+          # Clone repo
+          git clone --depth 1 https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git /repo
+          cd /repo/terraform
+
+          # Set S3 credentials
+          export AWS_ACCESS_KEY_ID=$(cat /run/secrets/s3/AWS_ACCESS_KEY_ID)
+          export AWS_SECRET_ACCESS_KEY=$(cat /run/secrets/s3/AWS_SECRET_ACCESS_KEY)
+          export AWS_ENDPOINT_URL=$(cat /run/secrets/s3/AWS_ENDPOINT_URL)
+
+          # Initialize and apply
+          echo "Initializing Terraform..."
+          terraform init
+
+          echo "Planning Terraform changes..."
+          terraform plan -out=tfplan
+
+          echo "Applying Terraform..."
+          terraform apply -auto-approve tfplan
+
+          echo "✓ Terraform apply complete"
+        volumeMounts:
+        - name: s3-creds
+          mountPath: /run/secrets/s3
+          readOnly: true
+        resources:
+          requests:
+            memory: "256Mi"
+            cpu: "250m"
+          limits:
+            memory: "1Gi"
+            cpu: "1"
+      volumes:
+      - name: s3-creds
+        projected:
+          sources:
+          - secret:
+              name: terraform-s3-creds
+              items:
+              - key: AWS_ACCESS_KEY_ID
+                path: AWS_ACCESS_KEY_ID
+              - key: AWS_SECRET_ACCESS_KEY
+                path: AWS_SECRET_ACCESS_KEY
+              - key: AWS_ENDPOINT_URL
+                path: AWS_ENDPOINT_URL
+      restartPolicy: Never